SingleFile

AI Security Review

Evidence context: threat category none; evidence quality moderate.

SingleFile saves a complete page into one HTML file. The version under review is 1.31.1, listed with 199 findings, and the totals record no criticals, no malware signatures, no external IoCs, no secrets, no code-smell hits and no dependency hits. What remains is a set of fetch calls and two obfuscation warnings, all of them inside bundled library code.

The network findings sit in files named for a storage destination. NET-FETCH-src/lib/dropbox/dropbox.js-304, together with the entries at lines 74, 100, 153, 183, 207 and 276 of the same file, covers the Dropbox upload and download paths. NET-FETCH-src/lib/gdrive/gdrive.js-82 is the Google Drive equivalent. NET-FETCH-src/core/bg/downloads.js-398 and NET-FETCH-src/core/bg/downloads.js-417 handle writing the saved file, NET-FETCH-src/core/bg/tabs.js-149 reads the tab being captured, and NET-FETCH-src/core/content/content.js-325 plus the two calls in src/core/bg/offscreen-document.js pass rendered content between the page and the background worker. Each of these talks to a service the user connects with their own account, or to the page already open in the browser. That is the extension doing its stated job.

The obfuscation findings are titled OBFUSCATION-invisible_unicode_payload and appear in lib/single-file.js and lib/single-file-extension-editor-helper.js. Both files are build output for the SingleFile library. Hidden characters in shipped JavaScript are a genuine way to smuggle instructions past a reviewer, so the rule is worth having. It also fires on byte sequences that minifiers and bundlers leave behind, and here it fired without a single accompanying signal from any other category. A payload hiding in plain sight usually brings a delivery endpoint or a credential grab with it. Neither exists in this scan.

A skeptic would point at the severity label and argue that a finding naming a payload deserves a closer look. That is reasonable, and the per-finding list does tag two of the obfuscation entries critical even though the category totals record no criticals at all, which is its own reason to hold that label loosely. The stronger counterweight is that the same warning repeats four times across two files of published open-source code, with no suspicious domain, no cookie or credential access, and no malware family match anywhere in the scan. Malicious bundling tends to leave more than one mark.

The manifest analysis records empty permission and host permission lists, so the extension does not ask for standing access to every site. Combined with the storage-only endpoints and the absence of any signature match, the findings describe a save-page tool reading its own build artifacts.

Key Reasons

• All 66 network findings are fetch or XHR calls in named storage and page-capture files such as src/lib/dropbox/dropbox.js, src/lib/gdrive/gdrive.js and src/core/bg/downloads.js
• Zero malware signatures, zero IoCs, zero secrets and zero code-smell matches across 199 findings
• OBFUSCATION-invisible_unicode_payload fires only on bundled build output, lib/single-file.js and lib/single-file-extension-editor-helper.js, with no accompanying suspicious domain or credential access
• Manifest analysis shows empty permission and host permission lists
• SingleFile is a known open-source project whose stated purpose matches the observed Dropbox, Drive and file-download behavior

False Positive Considerations

• Invisible-unicode obfuscation rule firing on a minified bundled library file
• Legitimate cloud-storage fetches (Dropbox, Google Drive) counted as network risk
• Finding count inflated by 133 informational entries
• Severity labels in the finding detail list contradict the category totals

Reviewed 2026-10-17; recommended action: suppress false positive; model confidence 85%.